A critical privilege escalation vulnerability in the Creator LMS plugin for WordPress allows authenticated attackers to modify sensitive system configurations.

This vulnerability involves a missing authorization check (CWE-862) within the SettingsController.php file, which permits authenticated users with contributor-level access or higher to update arbitrary WordPress options and potentially escalate privileges.

The ability for a contributor-level user to modify arbitrary WordPress options presents a high risk of total site compromise. By altering site settings, an attacker could change administrative accounts, redirect traffic, or disable security features, leading to unauthorized data access and potential long-term persistence. Given the CVSS score of 8.8, this flaw represents a significant threat to the integrity and availability of the affected WordPress environment.

Immediate Action: Update the Creator LMS plugin to version 1.1.13 or later immediately to resolve the missing capability check.

Proactive Monitoring: Review WordPress audit logs for any unexpected changes to site settings or the creation of new administrator accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to REST API endpoints associated with plugin settings.

Public Exploit Available: No

This vulnerability poses a severe risk to WordPress sites utilizing the Creator LMS plugin due to the ease with which attackers can manipulate system-level options. Administrators should verify their current plugin version and apply the 1.1.13 update without delay to prevent unauthorized privilege escalation and potential system takeover.